Communication Systems Security Overview University of Freiburg - - PowerPoint PPT Presentation
Communication Systems Security Overview University of Freiburg Computer Science Computer Networks and Telematics Prof. Christian Schindelhauer Organization I. Data and voice communication in IP networks II. Security issues in
University of Freiburg Computer Science Computer Networks and Telematics
Security Overview
Communication Systems
Computer Networks and Telematics University of Freiburg
2
Communication Systems
Computer Networks and Telematics University of Freiburg
networks, types and points of possible attacks
might occur
issues at once
counter measures
3
Communication Systems
Computer Networks and Telematics University of Freiburg
4
Communication Systems
Computer Networks and Telematics University of Freiburg
tools)
mode in LANs like ethernets)
tcpdump) from the last lectures
5
Communication Systems
Computer Networks and Telematics University of Freiburg
communication would be possible (think of people talk in different languages with each other)
network service are interpretable – such the samba service is developed through trial-and-error and reverse engineering
6
Communication Systems
Computer Networks and Telematics University of Freiburg
Network Insecurity
connected machines (in the beginning of IP networking)
simple and should not impose high loads on the machine
not common knowledge / restricted for export ("strategic technology”)
suite helped the rapid growth of the Internet and fast adaptation for the different operating systems
base technologies for information exchange and communication
depend on this network (online shops, auctions, b2b, multiplayer games, advertisements, porn sites, web services, ... :-))
7
Communication Systems
Computer Networks and Telematics University of Freiburg
Network Insecurity
moves from the classic communication media telephone and fax over to mail and similar technologies
wide range of digital objects
(spectacular some years ago) you could observe employees entering their offices at eight and leaving them at half past nine (no mail and online communication was available – most MS operated networks)
heavily depend on networks – most information between firms is directly interchanged between databases over the net
telecommunications into IP networks to avoid duplicated infrastructure and cut communication costs
8
Communication Systems
Computer Networks and Telematics University of Freiburg
middle attack, redirection of default gateway traffic over the attackers host (earlier exercise)
distinct boundaries):
(microwave oven) – frequency band is rendered unusable
Internet traffic over costly dial-in lines (attack is of course induced via web applications, trojan horses, ...)
9
Communication Systems
Computer Networks and Telematics University of Freiburg
Network Insecurity
addresses for good or malicious reasons for motivation of IPsec
e.g. RIP (II) for redirecting traffic in LANs, ICMP redirects, ...
unsolicited UDP packets – connectionless service (such spoof protocols like SNMP, DHCP, DNS, ...)
connections – grab an open telnet, mail, http session to use an authenticated session to a remote host
many TCP connections as possible from different hosts and leave them in open state without further communication – type of distributed denial of service DdoS)
(drop in replacement for TCP
weaknesses too ...
10
Communication Systems
Computer Networks and Telematics University of Freiburg
tunneling (discussed in later lecture)
providing tools to open a service tunnel over HTTP (because all other traffic is blocked)
defeating firewall restrictions to freely access the Internet
means not to play by the rules of the layering concept, thus allowing to transfer data without restrictions between the layers
11
Communication Systems
Computer Networks and Telematics University of Freiburg
12
Communication Systems
Computer Networks and Telematics University of Freiburg
However a tunnel may allow you to commit illegal activities (transfer data without permission, surf the web using a “free” account )
problem by introducing rules, that forbid the use of tunnels that fool their security systems. People who do not play by the rules will suffer certain penalties (e.g. get fired)
NSTX project team and their freely available sourcecode
13
Communication Systems
Computer Networks and Telematics University of Freiburg
IP-over-HTML / IP-over-WAP
(via proxy, transparent proxying
companies or lecture room environments
sales/service official would like to demonstrate some services which require open network access or simply work remote
via IMAP etc.)
here, but still of use in some other countries like Greece – depending
model)
a mobile provider (O2) for “flat Internet access for 5€” (really cool if true, but of course not – just WAP) – thus how to “enhance” the service for general IP
14
Communication Systems
Computer Networks and Telematics University of Freiburg
you will find rather similar setup in normal private/secured networks
just some ports
15
Communication Systems
Computer Networks and Telematics University of Freiburg
conforming request packets, universal network interface for the own applications
IPsec (too complex for many setups, more flexible for tunneling, NAT etc.)
interface) and HTTP proxy support
16
Communication Systems
Computer Networks and Telematics University of Freiburg
IP network
Option
for SSL-connects (caching useless)
17
Communication Systems
Computer Networks and Telematics University of Freiburg
like:
EudoraWeb 2.1
P800R102.xml
timeout
transfer of ~1,5MByte or a certain amount of time
18
Communication Systems
Computer Networks and Telematics University of Freiburg
networks
IP providers (which paid to be listed) in Windows2000 via toll-free number
general Internet access (just for free)
19
Communication Systems
Computer Networks and Telematics University of Freiburg
hotels, airports, our university, ...)
secured/authenticated tunnel or disabling of traffic (after authentication in both cases)
new DNS configuration thus DNS has to handle requests in both states (restricted and open)
will see the name resolved to some IP but nothing more happens (no routing)
20
Communication Systems
Computer Networks and Telematics University of Freiburg
21
Communication Systems
Computer Networks and Telematics University of Freiburg
minus NSTX header you get a payload of around 160Byte in every DNS request package
thus NSTX uses own fragment handling
22
Communication Systems
Computer Networks and Telematics University of Freiburg
allowed characters in domains!) thus theoretical size of 255 Byte payload (max. length of a name) is smaller
server through DNS queries. Now what about the other direction
fragments can be 223 bytes long )
DNS reply (!)
kind of keep-alive packets)
23
Communication Systems
Computer Networks and Telematics University of Freiburg
fragments means ten times the size of the needed headers (Ethernet, IP, UDP & DNS) and the remapping
hostname of the last query also has to be included
most important factor in the performance of the tunnel
from the outside
24
University of Freiburg Computer Science Computer Networks and Telematics